Add check, if Offset is greater then stream length when reading colorMapSize

brianpopow · brianpopow · commit 4b983db6b260 · 2026-03-08T17:17:49.000+01:00
diff --git a/src/ImageSharp/Formats/Bmp/BmpDecoderCore.cs b/src/ImageSharp/Formats/Bmp/BmpDecoderCore.cs
@@ -1548,6 +1548,12 @@ private int ReadImageHeaders(BufferedReadStream stream, out bool inverted, out b
                     case BmpFileMarkerType.Bitmap:
                         if (this.fileHeader.HasValue)
                         {
+                            if (this.fileHeader.Value.Offset > stream.Length)
+                            {
+                                BmpThrowHelper.ThrowInvalidImageContentException(
+                                    $"Pixel data offset {this.fileHeader.Value.Offset} exceeds file size {stream.Length}.");
+                            }
+
                             colorMapSizeBytes = this.fileHeader.Value.Offset - BmpFileHeader.Size - this.infoHeader.HeaderSize;
                         }
                         else

Original file line number	Diff line number	Diff line change
`@@ -1548,6 +1548,12 @@ private int ReadImageHeaders(BufferedReadStream stream, out bool inverted, out b`
`1548`	`1548`	`case BmpFileMarkerType.Bitmap:`
`1549`	`1549`	`if (this.fileHeader.HasValue)`
`1550`	`1550`	`{`
	`1551`	`+ if (this.fileHeader.Value.Offset > stream.Length)`
	`1552`	`+ {`
	`1553`	`+ BmpThrowHelper.ThrowInvalidImageContentException(`
	`1554`	`+ $"Pixel data offset {this.fileHeader.Value.Offset} exceeds file size {stream.Length}.");`
	`1555`	`+ }`
	`1556`	`+`
`1551`	`1557`	`colorMapSizeBytes = this.fileHeader.Value.Offset - BmpFileHeader.Size - this.infoHeader.HeaderSize;`
`1552`	`1558`	`}`
`1553`	`1559`	`else`